←Back to Home

Privacy Policy

Last updated: June 1, 2026

At ArcForge, we take your privacy seriously. This policy explains how we collect, use, protect, and handle your personal information.

Information We Collect

Account Information

  • Email address - Required for authentication and account recovery
  • Password (encrypted) - Hashed using bcrypt, never stored in plain text
  • Name (optional) - For personalization
  • Two-Factor Authentication data - TOTP secret (encrypted) and backup codes (encrypted)

Usage Data

  • Number of adventures created (for usage limits)
  • Features used (ArcForge generation, manual creation, exports)
  • Product analytics events such as page views, feature engagement, and conversion paths
  • Subscription tier and billing information
  • Last login date and activity timestamps

Content You Create

  • Adventures, scenes, characters, and story content
  • Maps and uploaded files
  • Version history of your work
  • Share settings (public links, read-only access)

Email Communications

  • Newsletter (optional): If you sign up for the ArcForge newsletter, we store your email address to send GM tips, guides, and product updates. You can unsubscribe at any time via the link in any email.
  • Transactional emails: Account notifications, password resets, and billing receipts are sent to your account email and cannot be opted out of while your account is active.

Solo Play & AI Interaction Data

  • Character data (name, class, stats, inventory, equipment) stored in your browser
  • Story choices and narrative inputs sent to our AI for content generation
  • Combat actions, dice rolls, and gameplay decisions
  • AI-generated scene text, narration, and game responses
  • Game state data (current scene, adventure progress) stored locally in your browser

Security & Technical Data

  • IP addresses (for security and fraud prevention)
  • Login history and failed login attempts
  • Session tokens and authentication data
  • Browser type and device information (standard HTTP headers)

How We Use Your Data

To Provide the Service:

  • Authenticate your account and maintain secure sessions
  • Store and retrieve your adventure content
  • Generate ArcForge-powered content based on your inputs
  • Power Solo Play AI interactions (scene generation, combat, narration)
  • Export PDFs and VTT files
  • Enable sharing features (public links)

To Enforce Usage Limits:

  • Track monthly ArcForge adventure generation counts
  • Apply subscription tier restrictions
  • Reset usage counters on billing dates

For Security & Fraud Prevention:

  • Detect suspicious login activity
  • Implement account lockouts after failed attempts
  • Monitor for abuse or violations of Terms of Service
  • Maintain audit logs for security incidents

To Improve ArcForge:

  • Analyze usage patterns and product flows using aggregated analytics
  • Fix bugs and technical issues
  • Develop new tools and capabilities

To Communicate With You:

  • Send critical account notifications (password changes, unusual activity)
  • Notify about subscription renewals and billing
  • Announce major feature updates (optional, can opt out)
  • Respond to support requests

How We Protect Your Data

Encryption

  • In Transit: All data transmitted using TLS 1.3 encryption (HTTPS)
  • At Rest: Database encrypted on disk (AES-256)
  • Passwords: Hashed using bcrypt with 12 rounds (industry standard)
  • Sensitive Fields: 2FA secrets and backup codes encrypted

Access Controls

  • Role-based access control (RBAC) for team members
  • Multi-factor authentication required for admin access
  • Principle of least privilege (minimal permissions)
  • Regular access audits and reviews

Infrastructure

  • Hosted on secure, SOC 2 compliant infrastructure
  • Regular automated backups (daily + incremental)
  • Geographic redundancy for disaster recovery
  • DDoS protection and rate limiting
  • Regular security patches and updates

Monitoring & Response

  • 24/7 automated security monitoring
  • Failed login attempt tracking and alerts
  • Anomaly detection for unusual activity
  • 72-hour breach notification commitment

Security Limitations

While we implement industry-standard security measures, no internet-connected system can be guaranteed 100% secure. We encourage you to use a strong, unique password and enable two-factor authentication. You are responsible for maintaining the security of your account credentials. Our liability for security incidents is governed by our Terms of Service.

Data Sharing & Third Parties

We DO NOT sell your personal information. Ever.

Limited Third-Party Services:

  • Payment Processing: Stripe (for subscriptions) - they receive billing info but NOT your adventure content
  • Content Generation Provider: OpenAI (GPT-4o-mini API) - receives prompts for content generation and Solo Play AI interactions, does not store them
  • Text-to-Speech: ElevenLabs - receives narration text for audio generation for the configured narration voice
  • Product Analytics: Google Analytics - receives page view and product interaction metadata to help us understand feature usage and site performance
  • Hosting: Database and server infrastructure providers - encrypted data only
  • Email: Transactional email service (for authentication and notifications)

Legal Requirements:

We may disclose data if required by law, court order, or to protect our legal rights, prevent fraud, or ensure user safety.

No Marketing Partners:

We do not share your data with advertisers or marketing companies.

Your Privacy Rights

Right to Access: Request a complete copy of all your data (JSON export)

Right to Deletion: Request permanent deletion of your account and all associated data

Right to Correction: Update or correct inaccurate personal information

Right to Portability: Export your adventures in PDF, JSON, or VTT format

Right to Opt-Out: Unsubscribe from optional marketing emails (account security emails required)

To exercise any of these rights, email support@myarcforge.com. We will respond within 30 days (45 days for California residents under CCPA).

Data Retention

  • Active Accounts: Data retained as long as your account is active
  • Cancelled Subscriptions: Free tier data retained; you can continue using free features
  • Account Deletion: All personal data deleted within 30 days (backups purged within 90 days)
  • Legal Requirements: Some data (billing records, security logs) retained for 7 years as required by law

Cookies & Tracking

Essential Cookies (Required):

  • Authentication session cookies (keeps you logged in)
  • Security tokens (CSRF protection)

Analytics Cookies and Measurement:

  • Google Analytics may set first-party cookies or similar identifiers to measure page views, session activity, and feature adoption
  • We use this information to evaluate performance, improve UX, and understand which tools are valuable to players and GMs
  • We do not use Google Analytics for advertising audiences, remarketing, or cross-site ad personalization

Browser Storage (Non-Cookie):

  • localStorage: Theme preference, cookie notice acknowledgment, Solo Play game state (character data, adventure progress, inventory)
  • IndexedDB: Offline game state cache (synced to your account)

We DO NOT use:

  • ❌ Advertising cookies or tracking pixels
  • ❌ Cross-site tracking
  • ❌ Google Analytics advertising features such as remarketing or demographic ad targeting

Mobile Application

ArcForge is available as a native mobile app (app ID: com.myarcforge.app) on Android (Google Play) and iOS (App Store). The mobile app collects the same data as the web app described in this policy, with the following additional notes:

Device Permissions

  • Internet access: Required to connect to ArcForge servers
  • No camera, microphone, contacts, or location access is requested
  • Any future permissions added will be disclosed here and within the app before being requested

On-Device Storage

  • Game state, character data, and session preferences are stored locally on your device using secure app storage
  • This data is not accessible to other apps on your device
  • Uninstalling the app removes all locally stored data

App Store Privacy

  • Google Play: ArcForge complies with Google Play's data safety requirements. Our data safety form reflects the disclosures in this policy.
  • Apple App Store: ArcForge complies with Apple's App Privacy requirements. Our privacy nutrition label reflects the disclosures in this policy.
  • The mobile app does not use advertising identifiers (IDFA/GAID)

Children's Privacy

ArcForge is not intended for children under 13. We do not knowingly collect personal information from children.

If you are a parent and believe your child has created an account, please contact us immediately at support@myarcforge.com and we will delete the account.

International Users

ArcForge operates globally. Your data may be stored and processed in the United States or other countries where our infrastructure providers operate. By using our services, you consent to such transfer and processing.

GDPR Compliance (EU/UK users): We comply with GDPR requirements including data portability, right to deletion, and consent management. Our lawful basis for processing is contractual necessity (to provide the Service) and legitimate interests (for security and service improvement).

US State-Specific Privacy Rights

California Residents (CCPA/CPRA)

  • Right to Know: Request disclosure of personal information collected about you in the past 12 months
  • Right to Delete: Request deletion of your personal data
  • Right to Opt-Out: Opt out of sale/sharing of personal information (we do not sell your data)
  • Right to Non-Discrimination: We will not discriminate against you for exercising your rights
  • Shine the Light: Under California Civil Code Section 1798.83, you may request information about disclosure to third parties for direct marketing. We do not disclose personal information for direct marketing.

Colorado, Connecticut, Virginia Residents

  • Right to Appeal: If we deny your privacy request, you have the right to appeal that decision
  • Right to Opt-Out of Profiling: You may opt out of profiling in furtherance of decisions producing legal effects. ArcForge does not engage in such profiling.

Nevada Residents

We do not sell your covered information as defined under Nevada Revised Statutes Chapter 603A.

To exercise any of these rights, email support@myarcforge.com. We will respond within 30 days (45 days for California residents). We may need to verify your identity before processing your request.

Changes to This Policy

We may update this Privacy Policy occasionally. Material changes will be announced via email and on our website.

Continued use of ArcForge after changes constitutes acceptance of the updated policy.

Contact Us

For privacy questions or to exercise your rights:

View Terms of Service → · Content & Safety Policy → · DMCA Policy →